VPN networks typically include multiple routers that use public infrastructure to communicate with each other (directly or indirectly) to create an overlay network across WAN links. The WAN can include, for example, the Internet, and the communication with the WAN is typically through a T1 interface, T3 interface, cable interface (cable modem), DSL interface or the like. VPN networks are convenient because they can be implemented with little or no effort to provide infrastructure and establish private and encrypted communication between devices that need to access each other but do not wish to be available via public infrastructure or the Internet to all other computers. VPN networks are convenient because they can be implemented with little or no private infrastructure. For example, it is generally not necessary to install additional cabling or install a wide area network. Once the connection to the WAN is provided, additional routers can be configured to communicate and thereby provide network access whose geographic coverage is theoretically limited only by the physically distribution of routers.
A virtual private network (VPN) is a network that typically uses public telecommunication infrastructure, such as the Internet, to provide remote offices or traveling users access to a central organizational network. VPNs typically require remote users of the network to be authenticated, and often secure data with encryption technologies to prevent disclosure of private information to unauthorized parties. VPNs may serve any network functionality that is found on any network, such as sharing of data and access to network resources, printers, databases, websites, etc. A VPN user typically experiences the central network in a manner that is identical to being connected directly to the central network.
A site-to-site VPN allows multiple geographically different fixed locations (sites) to establish secure connections with each other over a public network such as the Internet. A site-to-site VPN extends the company's network, making computer resources from one location available to other locations. An example of a company that needs a site-to-site VPN is a growing corporation with dozens of branch offices. A site-to-site VPN can be set up between two routers (that is, two network devices operating as routers) at the different sites that provide access to the WAN for that site (where these routers are also referred to as the VPN endpoints or VPN endpoint network devices). When multiple routers are part of the same VPN network, typically a VPN tunnel is created between each to form a mesh VPN.
Currently, to set up virtual private networks between routers, network administrator(s) for the organization has to: generate cryptographic keys to encrypt traffic; install keys on each pair of routers, which keys are used to establish the VPN tunnel between them; install remote endpoint network configuration on each router (i.e., tell each router about the others' IP addresses and ports); etc.
There are many disadvantages with the common methods of configuring mesh VPNs. A large number of error-prone manual human configuration steps are required. For instance, making configuration changes (i.e. changing a subnet) requires manual entry on multiple routers and is error prone. It is difficult to audit and keep track of the cryptographic keys used (i.e. generation and storage of these). Revocation of a device's access (i.e. removing a device from the VPN) requires manual configuration changes on every other router in the VPN. Devices cannot automatically verify and contact each other once they are configured.